EP3510743B1 - Récupération interchangeable de contenu sensible par l'intermédiaire de réseaux de distribution de contenu privés - Google Patents

Récupération interchangeable de contenu sensible par l'intermédiaire de réseaux de distribution de contenu privés Download PDF

Info

Publication number
EP3510743B1
EP3510743B1 EP17771922.6A EP17771922A EP3510743B1 EP 3510743 B1 EP3510743 B1 EP 3510743B1 EP 17771922 A EP17771922 A EP 17771922A EP 3510743 B1 EP3510743 B1 EP 3510743B1
Authority
EP
European Patent Office
Prior art keywords
cdn
content
cloud service
url
asset
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
EP17771922.6A
Other languages
German (de)
English (en)
Other versions
EP3510743A1 (fr
Inventor
Yauhen Shnitko
John D. Fan
Victor Magidson
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Microsoft Technology Licensing LLC
Original Assignee
Microsoft Technology Licensing LLC
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Microsoft Technology Licensing LLC filed Critical Microsoft Technology Licensing LLC
Publication of EP3510743A1 publication Critical patent/EP3510743A1/fr
Application granted granted Critical
Publication of EP3510743B1 publication Critical patent/EP3510743B1/fr
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/2866—Architectures; Arrangements
    • H04L67/2885—Hierarchically arranged intermediate devices, e.g. for hierarchical caching
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/60—Network streaming of media packets
    • H04L65/61—Network streaming of media packets for supporting one-way streaming services, e.g. Internet radio
    • H04L65/612—Network streaming of media packets for supporting one-way streaming services, e.g. Internet radio for unicast
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/06—Protocols specially adapted for file transfer, e.g. file transfer protocol [FTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/56—Provisioning of proxy services
    • H04L67/563—Data redirection of data network streams
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/56—Provisioning of proxy services
    • H04L67/568—Storing data temporarily at an intermediate stage, e.g. caching
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/60—Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources
    • H04L67/63—Routing a service request depending on the request content or context
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols

Definitions

  • Choosing a method to distribute content over the Internet often requires tradeoffs to be made in the speed of delivery and the level of control over that content.
  • a central distribution point such as a central cloud service
  • a content provider greater control over which clients access the content and greater ability to update the content but clients need to be authenticated and the central service may be located far away from the client - slowing the speed of delivery.
  • a content distribution network CDN
  • CDN content distribution network
  • Developers and providers of content are forced to choose between one method of delivery or another, and changing the delivery method is often unwieldy, time consuming, and resource intensive.
  • US 8 769614 B1 relates to preventing unauthorized access to online content, including in particular streaming video and other media.
  • Techniques are provided to authorize users and to authenticate clients (e.g., client media players) to a content delivery system.
  • the content delivery system may comprise a content delivery network with one or more content or "edge" servers therein.
  • the requesting client is sent a program at the time of content delivery.
  • the program may be embedded in the content stream, or sent outside of the stream.
  • the program contains instructions that are executed by the client and cause it to return identifying information to the content delivery system, which can then determine whether the client player is recognized and, if so, authorized to view the content. Unrecognized and/or altered players may be prevented from viewing the content.
  • US 2014/115724 A1 relates to a token-based validation method for delivery of at least part of a segmented content item and a content delivery system configured for executing such method.
  • Said segmented content item may be associated with at least one manifest file comprising one or more segment identifiers.
  • the method may comprise the steps of: a content processing device sending a first segment request message comprising a first segment identifier associated with a first segment to said at least one delivery node; generating first validation information for use with a further second segment request message, said first validation information comprising at least a first token and associated first timing information; and, sending a first response message and said first validation information to said content processing device, said first response message comprising at least part of said segment or location information associated with at least one delivery node for delivering said segment.
  • a hybrid content provisioning system and methods for the use thereof are described in the present disclosure.
  • a content provider may designate content to be provided via a central cloud service and content to be provided via a private content distribution network (CDN) and quickly transition which content source provides the content to the clients.
  • CDN content distribution network
  • the clients are thus provided with content faster than in environments where only a central cloud service is used and the content providers are given greater control over the access rights and ability to provide updated content than in environments where only a CDN is used.
  • computing devices may improve their functioning by reducing the amount of data that need to be transmitted among each other and reduce the amount of processing resources that need to be expended to share content over the Internet quickly and securely.
  • Examples are implemented as a computer process, a computing system, or as an article of manufacture such as a device, computer program product, or computer readable medium.
  • the computer program product is a computer storage medium readable by a computer system and encoding a computer program comprising instructions for executing a computer process.
  • the cloud service and the CDN comprise one or more computing devices configured to receive content from the tenant and share it via a network (e.g., the Internet) with authorized clients that request it.
  • the cloud service is a structured service that provides a centralized source for content that may include access controls to that content.
  • the CDN is a content provider that uses the cloud service as its source and distributes the content over a wider geographic area than the cloud service, to provide content faster and with less overhead than the cloud service.
  • the tenant seeking to distribute content is enabled to set which content assets are distributed via the cloud service and which are distributed by the CDN, and may quickly enable or disable the CDN as an available source for content assets without needing to configure how the content is distributed in the CDN and with minimal impact to the client.
  • FIGURE 1 illustrates an example environment 100 in which the present disclosure may be practiced.
  • a client device 110 is operable to communicate requests to the cloud service 120 and to receive content from a cloud service 120 and a CDN 130.
  • the cloud service 120 is in communication with a tenant device 140, by which the content provider may upload or remove content from cloud service 120 and may set how that content is to be made available to the client devices 110.
  • the cloud service 120 is also in communication with the CDN 130 to provide the CDN 130 with the content assets to enable the CDN 130 as an available content source to the client device 110 based on commands from the tenant device 140.
  • the commands from the tenant device 140 that include configuration settings for the CDN 130 may be transmitted directly to the CDN 130 or may be forwarded by the cloud service 120 from the tenant device 140.
  • the client device 110 and tenant device 140 are illustrative of a multitude of computing systems including, without limitation, desktop computer systems, wired and wireless computing systems, mobile computing systems (e.g., mobile telephones, netbooks, tablet or slate type computers, notebook computers, and laptop computers), hand-held devices, multiprocessor systems, microprocessor-based or programmable consumer electronics, minicomputers, printers, and mainframe computers.
  • client devices 110 are operated by clients, who may be humans or automated systems (e.g., "bots") that request content. For example, an instance of the SIRI®, GOOGLE NOWTM or CORTANA® electronic assistant (available from Apple, Inc.
  • tenant devices 140 are operated by tenants, who may be humans or automated systems that provide and manage content that is available for clients to request.
  • the tenant and the client may be the same entity, such as, for example, when a developer posts a webpage (as a tenant) and then verifies that the webpage displays properly by visiting (as a client) the live version of that webpage.
  • the cloud service 120 stores content for the tenant to provide to the client over a network (e.g., the Internet).
  • the cloud service 120 may be operated by the tenant or by a third party on behalf of the tenant at the tenant's direction.
  • the cloud service 120 may be a structured storage service or collaboration tool that is operable to restrict what content is available to certain clients. For example, a tenant may post content that is publically available so that any potential client may request and receive that content, but a tenant may also post content that is only available to a restricted set of potential clients (e.g., private to one entity, shared among a selected whitelist of entities, blocked from sharing according to a blacklist of entities).
  • one or more content items may be hosted in cloud services 120 such as ALFRESCOTM (available from Alfresco Software, Inc. of Atlanta, GA), HUDDLETM (available from Huddle, Inc. of London, UK), GOOGLE DRIVETM (available from Alphabet, Inc. of Mountain View CA), WORDPRESSTM (available from Automattic, Inc. of San Francisco, CA), SHAREPOINT® (available from Microsoft, Corp. of Redmond, WA), but may include other enterprise or personal content management systems.
  • ALFRESCOTM available from Alfresco Software, Inc. of Atlanta, GA
  • HUDDLETM available from Huddle, Inc. of London, UK
  • GOOGLE DRIVETM available from Alphabet, Inc. of Mountain View CA
  • WORDPRESSTM available from Automattic, Inc. of San Francisco, CA
  • SHAREPOINT® available from Microsoft, Corp. of Redmond, WA
  • Content may be organized within the cloud service 120 according to various "libraries,” “folders,” or “sites” that may have various permission levels.
  • the cloud service 120 when a request for content is received, will determine whether the requesting client is associated with the appropriate permission level to access the requested content, and may require the client device 110 to provide authentication (e.g., an authentication token, a username/password pair) before the requested content is transmitted to the client device 110.
  • authentication e.g., an authentication token, a username/password pair
  • a CDN 130 comprises a series of computing devices arranged in a tiered structure. Content is retrieved from a source (also referred to as a headend or origin) and is cached in progressively lower tiers of computing devices comprising the CDN 130 until the content is cached on an edge server for transmission to a client device 110 requesting that content.
  • the edge servers comprising the CDN 130 are widely distributed geographically so that content can be served to clients with less lag than a single centrally located content source; improving the speed at which content requests are responded to.
  • an edge server When an edge server does not have the content requested by a client, it will request that content from the next higher tier in the CDN 130, which in turn may forward the request to progressively higher tiers until a content source is reached, and the content is distributed through the chain of intermediary servers for provision to the edge server and is transmitted to the client device 110.
  • the servers comprising the CDN 130 may be pre-populated by the administrators of the CDN 130 in anticipation of client requests or may be populated in response to client requests; only those edge servers (and the servers in tiers above them) in communication with clients who have made requests for a given content asset will store the given content asset.
  • Each server comprising the CDN 130 may cache the content for a different length of time that may be configured by a tenant employing the CDN 130 or an administrator of the CDN 130 to free storage resources when the content item has not been requested for a given length of time or to comply with the retention policy for the content asset. For example, if no clients request a given content item from a first edge server for n days, the content item may be marked to be overwritten on the first edge server or may be deleted from the first edge server, but a second edge server may maintain the content item in its cache independently of the first edge server.
  • next higher tier may retain the content item for ( n +1) days without a client or edge server request for the content item to reduce the amount of data that need to be transferred between tiers of the CDN 130 if the content is requested again from an edge server after n days since the last request.
  • a CDN 130 unlike the cloud service 120, does not include authentication controls by which a client "logs in” to receive access to content; any requesting client with knowledge of a given Uniform Resource Locator (URL) hosted in the CDN 130 can receive the content asset associated with that URL unless the CDN 130 implements additional controls.
  • the CDN 130 may be managed by the tenant, but in other aspects may instead be a service provided by a third party to distribute the tenant's content more quickly to clients, who may be spread across multiple locations. Examples of third parties that provide CDNs 130 include, but are not limited to: Akamai Techs., Inc. of Cambridge, MA; Limelight Networks, Inc. of Tempe, AZ; and Level 3 Communications, Inc. of Broomfield, CO.
  • sensitive content assets i.e., those assets that the tenant does not want shared with the general public
  • sensitive content assets are stored in the cloud service 120 behind an access control scheme.
  • the hybrid system disclosed herein allows the tenant to extend the access control of the cloud service 120 to the CDN 130, while allowing the client to request the content asset from the most efficient source, to thereby make use of the advantages of each content provisioning system to improve the efficiency and speed of the systems used in accessing content.
  • the tenant may signal from the tenant device 140 what content assets that are stored in the cloud service 120 are allowed to be privately shared via the CDN 130.
  • the CDN 130 uses the cloud service 120 as its source from which to cache and distribute the assets to appropriate tiers within the CDN 130.
  • the tenant may signal from the tenant device 140 when one or more content assets are no longer allowed to be shared via the CDN 130 by transmitting a cache invalidation request to the CDN 130 and removing the cloud service 120 as a source for the given content assets in the CDN 130.
  • the cloud service 120 may also transmit a cache invalidation request while leaving the content asset available from the cloud service 120 to the CDN 130 to force the CDN 130 to request the newest version of a content asset to provide clients with newer or up-to-date versions of that content asset.
  • the client device 110 accesses the content via a web browser or other application that requests content items according to URLs associated with the content items.
  • web browsers often have limits on the number of concurrent requests for content that they may make to a single source, and content requests can often depend from one another; making small improvements to the speed for retrieving an individual content asset have a large impact on content items comprised of many assets.
  • a client accessing a website as a content item may request the webpage itself, which includes the Hypertext Markup Language (HTML) source for the webpage as well as multiple design elements such as JavaScript files, cascading style sheets (CSS), embedded video, audio files, images, etc., which all need to be requested from their associated source, and these elements may further specify other content assets that will later need to be requested (e.g., an image specified within a CSS) for the client to fully receive the content item.
  • HTML Hypertext Markup Language
  • CSS cascading style sheets
  • embedded video e.g., an image specified within a CSS
  • the sensitive content assets are referenced in a parent asset (e.g., a webpage, CSS file) hosted and served by the cloud service 120 behind its access control scheme.
  • the client is validated by the cloud service 120 and for each requested child asset of the parent asset (and grandchild assets), a new URL is generated pointing to the CDN 130 for accessing the sensitive child content assets via the CDN 130.
  • the CDN 130 is configured to extract token and key information from requests using this new URL to request, using these data, permission from the cloud service 120 to the release of content assets to the client using these data.
  • the CDN 130 When permission is received, the CDN 130 will release requested content assets that it stores, and will request (for subsequent storage and release) content assets from the cloud service 120 that it does not already store so that the CDN 130 does not need to be prepared/staged for sharing the sensitive content assets; the CDN 130 may be populated at runtime in response to client requests for content assets.
  • FIGURE 2 illustrates an example URL set 200 for a given content asset.
  • URLs are discussed herein for retrieving content from various sources, and the example URLs comprising the URL set 200 all point to the same example content asset for purposes of providing non-limiting examples of those URLs and their component elements.
  • the URL set 200 includes: a cloud URL 201, which points to the content asset as hosted by the cloud source 120; an authorization URL 202, by which the CDN 130 requests authorization from the cloud source 120 to provide sensitive content assets; a source URL 203, from which the CDN 130 receives the sensitive content assets for provision within the CDN 130 for distribution to client devices 110 ; and a CDN URL 204, at which the CDN 130 hosts the sensitive content assets and by which the client may request the sensitive content assets from the CDN 130.
  • Each URL of the URL set 200 is comprised of several elements, which include: a scheme 210, identifying a protocol for requesting the asset or specifying that the protocol to-be-used is chosen relative to a currently used protocol (e.g., http://, https://, ftp://, //); a host value 220, pointing to higher divisions of cloud service's URL (e.g., a domain name or IP address); a provided internal file path 230, specifying intermediary portions of cloud service's file path; an asset identifier 240, pointing to a given content asset; a query 250, which includes arguments for an expiration 251 and a key 252 as part of a token to provide limited access to the content asset; and a CDN address 270, that points to the top divisions of the tenant's addresses on the CDN 130.
  • the asset identifier 240 may include more than one forward slash delineated segment in various aspects to identify a set of locations and contained assets as a shared library.
  • the cloud source 120 converts the cloud URLs 201 in the parent content asset into the CDN URLs 204 for the client device 110 to request child content assets from the CDN 130.
  • the cloud source 120 provides the cloud URLs 201 for child assets in the parent content asset.
  • the token comprising an expiration 251 and a key 252, is integrated into the authorization URL 202, the source URL 203, and the CDN URL 204 as arguments of a query 250 for the sensitive content asset so that the sensitive content asset can be requested, but only for a limited time.
  • the token is issued by the cloud service 120 to authenticated clients to provide a time limited period in which the client can request sensitive child content assets from the CDN 130.
  • the token is uniquely created for each client and will be valid for a period of time set by the tenant. For example, a token may be generated for a first user and valid for n minutes so that a token may be used to request several content assets (or one content asset multiple times) from the CDN 130 that the first user is authorized to access within n minutes from token creation.
  • the shorter the duration for the validity of a token the more secure the CDN 130 will be in the event that the client shares the token with another client (e.g., via an email), but will encourage the client device 110 to rely on its local cache to avoid needing to query for the asset from the CDN 130, thus reducing network usage.
  • the expiration 251 of the token is presented as a plaintext time value at which the token is no longer valid.
  • the expiration 251 is provided as a number of millisecond since the Epoch began (an Epoch time) that indicates the time at which the token will expire.
  • the key 252 is generated according to the output of a hash function based on information contained in the cloud URL 201 and a timestamp (or other nonce), and includes the expiration 251 in its calculation of the hash.
  • a hash function yields a one-way encryption of data, which may be done according to various algorithms known to those of ordinary skill in the art (SHA-2, SHA256, MD5, BLAKE2, Keccak, GOST, etc.).
  • the key 252 may include additional information about itself related to: identifying a version of the hash construction rules, a signature or checksum for the key 252, as well as the output of the hash function.
  • the key 252 provides data by which parties may confirm the authenticity of the token, and thereby the authenticity of URLs that include the token.
  • the cloud service 120 validates that the user requesting the content asset has permission to be provided the content asset in question.
  • the key 252 will be generated, but when the requesting user does not have permission, the cloud service 120 will not generate the key 252 and the cloud service 120 will instead provide the cloud URL 201, by which the requesting user may negotiate with the cloud service 120 to receive the linked-to content asset.
  • the key 252 acts as an anonymous access token, allowing anyone who possesses the key 252 to access the linked-to content asset, the inclusion of the expiration 251 prevents unbounded sharing of the URLs from authorized users to other users (authorized or otherwise) to access those content assets.
  • the time noted in the expiration 251 is passed, the URL no longer is treated as valid by the CDN 130 or the cloud service 120.
  • the key 252 is created on the cloud service 120 for the location specified by the tenant device 140 by running the hash function on at least a portion of the cloud URL 201 and a timestamp (or other nonce).
  • the cloud URL 201 may be converted to all uppercase, all lowercase, or another normalization of character encodings before being hashed.
  • the entire cloud URL 201 may be hashed, resulting in a unique hash value for each content asset, or only the first X characters (e.g., the host value 220 and at least a portion of the internal file path 270 ) of the cloud URL 201 to provide hash values that are shared for a given file path.
  • the content asset(s) are then hosted by the cloud service 120 at the source URL 203, and when the CDN 130 is enabled as a content source, the CDN 130 will be provided the CDN URL 204 and will construct the authorization URL 202 and source URL 203 via internal logic to retrieve the content assets from the cloud service 120 as a source to host the content asset(s) in the CDN 130 according to the CDN URL 204.
  • the CDN URL 204 points to the content asset as it is hosted by the CDN 130 and provides the CDN 130 with the token (including the expiration 251 and key 252 ) to determine whether the client is authorized to access that content.
  • the CDN URL 204 includes: a scheme 210 ; a CDN address 270 ; the host value 220, from the tenant's cloud service 120 ; the file path 230 ; the asset identifier 240 ; and a query 250 including the expiration 251 and key 252 as arguments.
  • the file path 230 may be omitted, modified from that used in the cloud URL 201, or replaced with a hash value to obfuscate the storage pathway used by the cloud service 120.
  • the CDN 130 In response to the CDN 130 receiving a request for the content asset from the client device 110 that includes the CDN URL 204, the CDN 130 is operable to produce the authorization URL 202, to determine from the cloud service 120 whether the client is authorized to access the requested content asset, and the source URL 203, from which to request the content asset if the content asset is not already cached by the CDN 130.
  • Both of the authorization URL 202 and the source URL 203 include: a scheme 210 ; the host value 220 ; the file path 230 ; the asset identifier 240 ; and a query 250 including the expiration 251 and key 252 as arguments.
  • the file path 230 may be omitted, modified from that used in the cloud URL 201, or replaced with a hash value to obfuscate the storage pathway used by the cloud service 120.
  • the asset identifier 240 may be omitted.
  • the authorization URL 202 differs from the source URL 203 in that the authorization URL 202 includes a client authorization pathway 260, whereas the source URL 203 includes an item authorization pathway 265.
  • the CDN 130 contacts the cloud source 120 via the authorization URL 202 (including the client authorization pathway 260 ) to pass the expiration 251 and key 252 to the cloud source 120 to determine whether the identified client is authorized to receive the requested content asset or content assets from the identified library. When the token is valid, the CDN 130 will receive authorization from the cloud source 120 and will transmit the content assets to the authorized clients, if the CDN 130 already caches the content assets requested.
  • the CDN 130 When the CDN 130 does not cache the content assets requested by the authorized client, the CDN 130 contacts the cloud source 120 via the source URL 203 (including the item authorization pathway 265 ) to pass the expiration 251 and key 252 to the cloud source 120 to determine whether the identified content asset or library is available for sharing via the CDN 130. When the content asset or library is available for sharing via the CDN 130, the cloud source 120 will pass those requested content assets to the CDN 130 for caching and distribution.
  • the client device 110 receives an error message from the CDN 130 that the content asset is not available from the CDN 130 (e.g., a 404 message).
  • the content assets may be distributed within the CDN 130 automatically or based on client requests for the content assets at the CDN URLs 204.
  • the CDN 130 receives a request for a content asset that it does not currently possess, it may send a request to a higher tier within the CDN 130 or the cloud service 120 to retrieve that content asset.
  • the CDN 130 will respond to the client device 110 that the CDN 130 is not a valid source (e.g., via a 401, 403, 404, 406, 410, 421, 451 or other network code - see, IETF RFC 7231) and the client device 110 may request the content asset from the cloud service 120 by using the cloud URL 201.
  • a valid source e.g., via a 401, 403, 404, 406, 410, 421, 451 or other network code - see, IETF RFC 7231
  • FIGURE 2 the text and order of elements given in the illustrated example may be modified from what is shown in FIGURE 2 to meet the needs of various implementations; one of ordinary skill in the art will recognize FIGURE 2 and the associated discussion as providing a non-limiting explanation of a URL set 200.
  • the format of the URLs comprising the URL set 200 allows for the conversion from one URL to another.
  • the elements of each URL that are shared in common may be reordered according to a definition provided via tenant-supplied logic (e.g., as part of a CSS or JavaScript file provided from the tenant) to the client device 110 or CDN 130, and any elements that are unique to one URL may similarly be removed or inserted during a conversion based on a definition provided to the client device 110 or CDN 130.
  • FIGURE 3 is a flow chart showing general stages involved in an example method 300 for enabling hybrid content sourcing for the interchangeable provision of content.
  • Method 300 may be performed in response to the first or a subsequent time that hybrid content sourcing is enabled by a tenant.
  • Content assets may include, as parent assets, links that are formatted as URLs to child content assets or design elements.
  • a content asset of an HTML, CSS, or JavaScript object may reference another content asset via a URL.
  • Content assets provided to client devices 110 may include URLs inserted to link to the content asset as hosted by the cloud service 120 or the CDN 130.
  • Method 300 begins at OPERATION 310, where a tenant identifies sensitive content to distribute via the CDN 130 to supplement the distribution of content via the cloud service 120.
  • Tenant preferences received from a tenant device 140, dictate which content assets are identified as to be distributable via a CDN 130.
  • the identified content will have the URL at which it is hosted for client consumption (i.e., the cloud URL 201 ) hashed at OPERATION 320, and that hash will be used to create the key 252 for that content asset (or library).
  • the key 252 includes version information, and a checksum or signature in addition to the output of the hash of the cloud URL 201.
  • the cloud URL 201 is hashed without an asset identifier 240 so that multiple content assets using similar file paths but for different asset identifiers 240 may use the same key 252.
  • the key is used to configure the authorization URL 202 and source URL 203 at which the content asset is hosted for provision by the cloud service 120 as a source for the CDN 130.
  • the cloud service 120 will only respond to communications that use the authorization URL 202 and source URL 203 that originate from the CDN 130, and even then only when the tenant has signaled to the cloud service 120 that distribution from the CDN 130 is enabled (OPERATION 340 ) and it is determined that the client is authorized to access the content asset.
  • OPERATION 340 When distribution from the CDN 130 is enabled, requests from entities other than the CDN 130 will be rejected, although the cloud service 120 may respond with an Access Denied or other appropriate error code to the requesting entity.
  • requests from the CDN 130 using the authorization URL 202 or source URL 203 will be verified based on the included expiration 251 and key 252.
  • requests may be identified as originating from the CDN 130 via a whitelist of known IP addresses associated with the CDN 130 or Signature Header Authentication, where headers are signed with a secret that is shared between the cloud service 120 and the CDN 130.
  • the cloud service 120 and the CDN 130 are configured to enable the CDN 130 to serve content assets.
  • the configuration is signaled from a tenant device 140 to the cloud service 120, which in turn signals the CDN 130 to begin requesting content hosted in the cloud service 120 via the designated source URLs 203.
  • the cloud service 120 may provide the CDN 130 with a list of source URLs 203 and logic on how to convert the source URLs 203 into CDN URLs 204 or the keys 252 and logic to construct the URLs from the URL set 200, retention policies for the content assets in the CDN 130 (e.g., n days), and may provide a shared secret so that requests for content assets from the source URLs 203 may be appropriately signed.
  • a tenant may provide, via a tenant device 140, the conversion logic, retention policies, or shared secret directly to the CDN 130 or have the cloud service 120 forward those data to the CDN 130. Method 300 may then conclude.
  • FIGURE 4 is a flow chart showing general stages involved in an example method 400 for disabling hybrid content sourcing for the interchangeable provision of sensitive content.
  • Method 400 may be performed in response to the tenant completely disabling the CDN 130 for content sourcing, or in response to removing one or more specific content assets or libraries of content assets from distribution by the CDN 130.
  • Method 400 begins at OPERATION 410 where the tenant identifies, via the tenant device 140, to the cloud service 120 content that is no longer to be distributed via the CDN 130 in conjunction with distribution via the cloud service 120.
  • Content assets may be identified individually, if the keys 252 were created to originally share those content assets on a per asset basis, otherwise, if the keys 252 were created to identify libraries from which content assets could be shared, the libraries will be identified to remove from distribution via the CDN 130.
  • the tenant may signal one or more content assets or libraries to be removed from distribution via the CDN 130 (up to and including all of the tenant's content) and may re-enable that content for distribution via the CDN 130 at a later time according to method 300.
  • the cloud service 120 stops hosting the identified content assets from the source URLs 203.
  • the source URLs 203 are made unavailable; all requests that use the source URLs 203 will be rejected.
  • the associated authorization URLs 202 may also be made unavailable.
  • the authorization URLs 202 and source URLs 203 are deleted from the cloud service 120 ; the content and content assets are removed.
  • a list of clients or tokens that are authorized to request the content assets may be cleared and locked to a null state; preventing any clients from being recognized as authorized for the CDN 130 to cache content for.
  • OPERATION 430 the keys 252 for the identified content assets are invalidated to ensure that content assets to-be-purged are not repopulated on the CDN 130 upon user request. Subsequent requests from client devices 110 will be rejected as the CDN URLs 204 that are used to request the content assets will not contain a key 252 that is recognized by the cloud service 120. OPERATION 430 prevents the CDN 130 from repopulating its caches with content assets that are no longer allowed for sharing via the CDN 130.
  • the tenant device 140 sends a cache clear command to the CDN 130, which in some aspects may be received and forwarded by the cloud service 120 from the tenant device 140 to the CDN 130.
  • the cache clear command identifies the content assets that are to be unavailable for distribution from the CDN 130 and causes the CDN 130 to delete those content assets from its storage tiers or otherwise make those content assets unavailable to client devices 110 (e.g., mark for overwriting).
  • the tenant may perform OPERATIONS 410 and 440 independently of method 400 to force the CDN 130 to update identified content assets. Method 400 may then conclude.
  • FIGURE 5 is a flow chart showing general stages involved in an example method 500 for a client device 110 to interchangeably request content assets when provided a single address via hybrid content sourcing.
  • Method 500 begins at OPERATION 510, where the client device 110 transmits a request for content to the cloud service 120.
  • the cloud service 120 will authenticate the client using the client device 110 and may provide content to the client device 110 in response to the request when the client has the appropriate permissions to access the requested content, and otherwise may reject the request.
  • the cloud service 120 After the cloud service 120 has authenticated the client, the cloud service 120 will determine whether to provide one or more CDN URLs 204 that include an expiration 251 and a key 252 when the CDN 130 is available or one or more associated cloud URLs 201 from the related URL set 200 when the CDN 130 is unavailable, which are included in a parent content asset (e.g., a webpage), which the client device 110 receives at OPERATION 520.
  • a parent content asset e.g., a webpage
  • the client device 110 receives a parent content asset including the URLs for child content assets as selected and inserted by the cloud service 120.
  • the client may have requested a webpage (a parent content asset) that includes a URL requesting an image and a CSS (child content assets of the webpage), wherein the CSS requests another image (as a child content asset of the CSS).
  • the cloud service 120 determines whether to provide a cloud URL 201 linking to the child content assets hosted on the cloud service 120 or a CDN URL 204 for retrieving the content asset via the CDN 130.
  • the client device 110 will request the content asset from the cloud service 120 or the CDN 130 based on the provided URL in the parent content asset.
  • the CDN URL 204 is constructed with the expiration 251 and the key 252 that limits the time period in which the client device 110 may request the child assets from the CDN 130. Method 500 may then conclude.
  • FIGURE 6 is a flow chart showing general stages involved in an example method 600 for a CDN 130 to verify whether a requested content asset that is sensitive can be provided to a requesting client.
  • Method 600 beings at OPERATION 610, where a request for a content asset is received by the CDN 130 from a client device 110.
  • the request for the content asset includes the CDN URL 204 associated with that content asset, which includes an expiration 251 for the client and a key 252 for the content asset as arguments of its query 250.
  • Method 600 proceeds to OPERATION 620, where authorization to distribute the content asset to the client is requested by the CDN 130 from the cloud service 120.
  • the CDN 130 requests authorization for the client from the cloud service 120 via the authorization URL 202, which includes the client's token including an expiration 251 and the content item's key 252 as elements of the query 250.
  • the CDN 130 issues a HEAD call or similar request to the cloud service 120 for the content asset using the authorization URL 202.
  • the cloud service 120 evaluates the request and attempts to validate the token.
  • an authorization code is transmitted to the CDN 130, whereas when the cloud service 120 fails to validate (or invalidates) the token, no authorization code is transmitted to the CDN 130 or an error/failure code is transmitted instead.
  • DECISION 630 it is determined by the CDN 130 whether the client is authorized to receive the content asset from the CDN 130.
  • the receipt of an authorization code is used to determine that the client is authorized, while the receipt of an error/failure code or a lack of an authorization code after a predetermined period of time (e.g., a timeout) is used to determine that the client is not authorized.
  • a predetermined period of time e.g., a timeout
  • the CDN 130 determines whether the requested content has been cached at DECISION 640. When it is determined that the requested sensitive content is already cached with the CDN 130, method 600 proceeds to OPERATION 650. When it is determined that the requested sensitive content is not cached within the CDN 130, method 600 proceeds to OPERATION 660.
  • the requested content is transmitted to the client device 110 from which the request of OPERATION 610 was received.
  • the content may be cached at a tier above an end server, in which case the CDN 130 may distribute the content asset internally before transmitting the content asset to the client device 110.
  • method 600 proceeds to OPERATION 660, where a request is made to the cloud service 120 for the content assets requested by the client.
  • the CDN 130 issues a GET call or similar request to the cloud service 120 for the content asset using the source URL 203.
  • the cloud service 120 may revalidate the token submitted with the request to determine whether the content asset requested is authorized for sharing with the given client.
  • DECISION 670 it is determined whether content that was requested is authorized for distribution by the CDN 130. In various aspects, it may be determined that the content is authorized for distribution when the CDN 130 receives the content asset or a success message from the cloud service 120. In various aspects, it may be determined that the content is not authorized for distribution when the CDN 130 does not receive the content asset or a success message from the cloud service 120 after a set period of time (e.g., the request times out) or a failure message is received by the CDN 130 from the cloud service 120.
  • a set period of time e.g., the request times out
  • the CDN 130 When it is determined at DECISION 670 that the content is authorized for distribution by the CDN 130, the CDN 130 receives the content assets from the cloud service 120 and will cache the content assets according to the retention policies and layout of the CDN 130 at OPERATION 680. Method 600 then proceeds to OPERATION 650, where the content asset is transmitted to the client device 110, and method 600 may then conclude.
  • method 600 may conclude without receiving the content asset from the cloud service 120.
  • the CDN 130 may receive an error message or a forbidden message from the cloud service 120 indicating that the content asset is not authorized, or the request from CDN 130 may time out and method 600 may then conclude.
  • Method 600 may conclude without transmitting the content asset to the client device 110 from the CDN 130 in response to DECISION 630 or DECISION 670 determining that either the client or the content asset is not authorized for sharing via the CDN 130.
  • the CDN 130 may optionally provide the client device 110 with an error code, signal to the client device 110 which authorization the client lacks, or signal the client device 110 to request the content asset from the cloud service 120 before method 600 concludes.
  • program modules include routines, programs, components, data structures, and other types of structures that perform particular tasks or implement particular abstract data types.
  • computing systems including, without limitation, desktop computer systems, wired and wireless computing systems, mobile computing systems (e.g., mobile telephones, netbooks, tablet or slate type computers, notebook computers, and laptop computers), hand-held devices, multiprocessor systems, microprocessor-based or programmable consumer electronics, minicomputers, and mainframe computers.
  • mobile computing systems e.g., mobile telephones, netbooks, tablet or slate type computers, notebook computers, and laptop computers
  • hand-held devices e.g., multiprocessor systems, microprocessor-based or programmable consumer electronics, minicomputers, and mainframe computers.
  • the aspects and functionalities described herein operate over distributed systems (e.g., cloud-based computing systems), where application functionality, memory, data storage and retrieval and various processing functions are operated remotely from each other over a distributed computing network, such as the Internet or an intranet.
  • a distributed computing network such as the Internet or an intranet.
  • user interfaces and information of various types are displayed via on-board computing device displays or via remote display units associated with one or more computing devices. For example, user interfaces and information of various types are displayed and interacted with on a wall surface onto which user interfaces and information of various types are projected.
  • Interaction with the multitude of computing systems with which implementations are practiced include, keystroke entry, touch screen entry, voice or other audio entry, gesture entry where an associated computing device is equipped with detection (e.g., camera) functionality for capturing and interpreting user gestures for controlling the functionality of the computing device, and the like.
  • detection e.g., camera
  • FIGURES 7-8B and the associated descriptions provide a discussion of a variety of operating environments in which examples are practiced.
  • the devices and systems illustrated and discussed with respect to FIGURES 7-8B are for purposes of example and illustration and are not limiting of a vast number of computing device configurations that are utilized for practicing aspects, described herein.
  • FIGURE 7 is a block diagram illustrating physical components (i.e., hardware) of a computing device 700 with which examples of the present disclosure may be practiced.
  • the computing device 700 includes at least one processing unit 702 and a system memory 704.
  • the system memory 704 comprises, but is not limited to, volatile storage (e.g., random access memory), non-volatile storage (e.g., read-only memory), flash memory, or any combination of such memories.
  • the system memory 704 includes an operating system 705 and one or more program modules 706 suitable for running software applications 750.
  • the application 750 includes applications by which a tenant may control the distribution of content assets via a hybrid distribution system or a client may request content according to the present disclosure.
  • the operating system 705, for example, is suitable for controlling the operation of the computing device 700.
  • aspects are practiced in conjunction with a graphics library, other operating systems, or any other application program, and are not limited to any particular application or system.
  • This basic configuration is illustrated in FIGURE 7 by those components within a dashed line 708.
  • the computing device 700 has additional features or functionality.
  • the computing device 700 includes additional data storage devices (removable and/or non-removable) such as, for example, magnetic disks, optical disks, or tape. Such additional storage is illustrated in FIGURE 7 by a removable storage device 709 and a non-removable storage device 710.
  • a number of program modules and data files are stored in the system memory 704. While executing on the processing unit 702, the program modules 706 (e.g., applications 750 ) perform processes including, but not limited to, one or more of the stages of the methods 300, 400, and 500 illustrated in FIGURES 3-5 .
  • other program modules are used in accordance with examples and include applications such as electronic mail and contacts applications, word processing applications, spreadsheet applications, database applications, slide presentation applications, drawing or computer-aided application programs, etc.
  • the computing device 700 has one or more input device(s) 712 such as a keyboard, a mouse, a pen, a sound input device, a touch input device, etc.
  • the output device(s) 714 such as a display, speakers, a printer, etc. are also included according to an aspect.
  • the aforementioned devices are examples and others may be used.
  • the computing device 700 includes one or more communication connections 716 allowing communications with other computing devices 718. Examples of suitable communication connections 716 include, but are not limited to, radio frequency (RF) transmitter, receiver, and/or transceiver circuitry; universal serial bus (USB), parallel, and/or serial ports.
  • RF radio frequency
  • USB universal serial bus
  • Computer readable media includes computer storage media.
  • Computer storage media include volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information, such as computer readable instructions, data structures, or program modules.
  • the system memory 704, the removable storage device 709, and the non-removable storage device 710 are all computer storage media examples (i.e., memory storage.)
  • computer storage media include RAM, ROM, electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other article of manufacture which can be used to store information and which can be accessed by the computing device 700.
  • any such computer storage media is part of the computing device 700.
  • Computer storage media do not include a carrier wave or other propagated data signal.
  • communication media are embodied by computer readable instructions, data structures, program modules, or other data in a modulated data signal, such as a carrier wave or other transport mechanism, and include any information delivery media.
  • modulated data signal describes a signal that has one or more characteristics set or changed in such a manner as to encode information in the signal.
  • communication media include wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, radio frequency (RF), infrared, and other wireless media.
  • FIGURES 8A and 8B illustrate a mobile computing device 800, for example, a mobile telephone, a smart phone, a tablet personal computer, a laptop computer, and the like, with which aspects may be practiced.
  • a mobile computing device 800 for example, a mobile telephone, a smart phone, a tablet personal computer, a laptop computer, and the like, with which aspects may be practiced.
  • FIGURE 8A an example of a mobile computing device 800 for implementing the aspects is illustrated.
  • the mobile computing device 800 is a handheld computer having both input elements and output elements.
  • the mobile computing device 800 typically includes a display 805 and one or more input buttons 810 that allow the user to enter information into the mobile computing device 800.
  • the display 805 of the mobile computing device 800 functions as an input device (e.g., a touch screen display). If included, an optional side input element 815 allows further user input.
  • the side input element 815 is a rotary switch, a button, or any other type of manual input element.
  • mobile computing device 800 incorporates more or fewer input elements.
  • the display 805 may not be a touch screen in some examples.
  • the mobile computing device 800 is a portable phone system, such as a cellular phone.
  • the mobile computing device 800 includes an optional keypad 835.
  • the optional keypad 835 is a physical keypad.
  • the optional keypad 835 is a "soft" keypad generated on the touch screen display.
  • the output elements include the display 805 for showing a graphical user interface (GUI), a visual indicator 820 (e.g., a light emitting diode), and/or an audio transducer 825 (e.g., a speaker).
  • GUI graphical user interface
  • the mobile computing device 800 incorporates a vibration transducer for providing the user with tactile feedback.
  • the mobile computing device 800 incorporates input and/or output ports, such as an audio input (e.g., a microphone jack), an audio output (e.g., a headphone jack), and a video output (e.g., a HDMI port) for sending signals to or receiving signals from an external device.
  • the mobile computing device 800 incorporates peripheral device port 840, such as an audio input (e.g., a microphone jack), an audio output (e.g., a headphone jack), and a video output (e.g., a HDMI port) for sending signals to or receiving signals from an external device.
  • peripheral device port 840 such as an audio input (e.g., a microphone jack), an audio output (e.g., a headphone jack), and a video output (e.g., a HDMI port) for sending signals to or receiving signals from an external device.
  • FIGURE 8B is a block diagram illustrating the architecture of one example of a mobile computing device. That is, the mobile computing device 800 incorporates a system (i.e., an architecture) 802 to implement some examples.
  • the system 802 is implemented as a "smart phone" capable of running one or more applications (e.g., browser, e-mail, calendaring, contact managers, messaging clients, games, and media clients/players).
  • the system 802 is integrated as a computing device, such as an integrated personal digital assistant (PDA) and wireless phone.
  • PDA personal digital assistant
  • one or more application programs 850 are loaded into the memory 862 and run on or in association with the operating system 864.
  • Examples of the application programs include phone dialer programs, e-mail programs, personal information management (PIM) programs, word processing programs, spreadsheet programs, Internet browser programs, messaging programs, and so forth.
  • the system 802 also includes a non-volatile storage area 868 within the memory 862.
  • the non-volatile storage area 868 is used to store persistent information that should not be lost if the system 802 is powered down.
  • the application programs 850 may use and store information in the non-volatile storage area 868, such as e-mail or other messages used by an e-mail application, and the like.
  • a synchronization application (not shown) also resides on the system 802 and is programmed to interact with a corresponding synchronization application resident on a host computer to keep the information stored in the non-volatile storage area 868 synchronized with corresponding information stored at the host computer.
  • other applications may be loaded into the memory 862 and run on the mobile computing device 800.
  • the system 802 has a power supply 870, which is implemented as one or more batteries.
  • the power supply 870 further includes an external power source, such as an AC adapter or a powered docking cradle that supplements or recharges the batteries.
  • the system 802 includes a radio 872 that performs the function of transmitting and receiving radio frequency communications.
  • the radio 872 facilitates wireless connectivity between the system 802 and the "outside world," via a communications carrier or service provider. Transmissions to and from the radio 872 are conducted under control of the operating system 864. In other words, communications received by the radio 872 may be disseminated to the application programs 850 via the operating system 864, and vice versa.
  • the visual indicator 820 is used to provide visual notifications and/or an audio interface 874 is used for producing audible notifications via the audio transducer 825.
  • the visual indicator 820 is a light emitting diode (LED) and the audio transducer 825 is a speaker.
  • LED light emitting diode
  • the LED may be programmed to remain on indefinitely until the user takes action to indicate the powered-on status of the device.
  • the audio interface 874 is used to provide audible signals to and receive audible signals from the user.
  • the audio interface 874 may also be coupled to a microphone to receive audible input, such as to facilitate a telephone conversation.
  • the system 802 further includes a video interface 876 that enables an operation of an on-board camera 830 to record still images, video stream, and the like.
  • a mobile computing device 800 implementing the system 802 has additional features or functionality.
  • the mobile computing device 800 includes additional data storage devices (removable and/or non-removable) such as, magnetic disks, optical disks, or tape.
  • additional storage is illustrated in FIGURE 8B by the non-volatile storage area 868.
  • data/information generated or captured by the mobile computing device 800 and stored via the system 802 are stored locally on the mobile computing device 800, as described above.
  • the data are stored on any number of storage media that are accessible by the device via the radio 872 or via a wired connection between the mobile computing device 800 and a separate computing device associated with the mobile computing device 800, for example, a server computer in a distributed computing network, such as the Internet.
  • a server computer in a distributed computing network such as the Internet.
  • data/information are accessible via the mobile computing device 800 via the radio 872 or via a distributed computing network.
  • data/information are readily transferred between computing devices for storage and use according to well-known data/information transfer and storage means, including electronic mail and collaborative data/information sharing systems.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Multimedia (AREA)
  • Information Transfer Between Computers (AREA)

Claims (11)

  1. Procédé pour distribuer un actif de contenu hébergé au niveau d'un service d'informatique en nuage à un dispositif client de façon interchangeable par l'intermédiaire du service informatique en nuage ou d'un Réseau de Distribution de Contenu, CDN, le procédé comprenant :
    l'identification (310) d'un actif de contenu à distribuer via un Réseau de Distribution de Contenu, CDN (130), en relation avec un service d'informatique en nuage (120) hébergeant l'actif de contenu au niveau d'une Adresse universelle, URL, de nuage (201) disponible pour un dispositif client (110) pour demander l'actif de contenu ;
    la création (320) d'une valeur clef (252) sur la base de l'URL de nuage ;
    la transformation (340), par le service d'informatique en nuage, de l'URL de nuage en une URL de CDN (204), dans lequel l'URL de CDN pointe sur une adresse pour que le CDN fournisse l'actif de contenu au dispositif client et l'URL de CDN inclut la valeur clef ;
    la fourniture, en provenance du service d'informatique en nuage à destination du dispositif client, d'un jeton d'authentification associé à un client et à la valeur clef ;
    la réception d'une demande d'autorisation provenant du CDN pour distribuer l'actif de contenu au dispositif client, la demande d'autorisation incluant la valeur clef et le jeton d'authentification ;
    la vérification du jeton d'authentification ; et
    l'émission, en provenance du service d'informatique en nuage, d'un code d'autorisation au CDN pour permettre au CDN de distribuer l'actif de contenu au dispositif client au niveau de l'URL de CDN.
  2. Procédé selon la revendication 1, dans lequel la création de la valeur clef comprend :
    le paramétrage d'un temps d'expiration pour le jeton d'autorisation ;
    la production d'un nombre aléatoire ; et
    le hachage d'une combinaison du temps d'expiration, du nombre aléatoire et d'au moins une portion de l'URL de nuage.
  3. Procédé selon la revendication 1, dans lequel le jeton d'authentification inclut une expiration en texte en clair indiquant un temps après lequel le jeton d'authentification est périmé.
  4. Procédé selon la revendication 1, dans lequel l'actif de contenu est fourni au dispositif client en provenance du service d'informatique en nuage en réponse au service d'informatique en nuage autorisant le dispositif client à recevoir l'actif de contenu.
  5. Procédé selon la revendication 1, comprenant en outre :
    l'identification (410) d'un actif de contenu donné qui est actuellement distribué via le CDN en relation avec le service d'informatique en nuage qui ne doit plus être distribué via le CDN ;
    la suppression (420) de l'actif de contenu donné de l'hébergement par le service d'informatique en nuage au niveau d'une URL source donnée associé à l'actif de contenu donné ;
    l'envoi (440), en provenance du service d'informatique en nuage, d'un ordre d'effacement de cache au CDN ; et
    l'invalidation (430) du jeton d'authentification.
  6. Procédé selon la revendication 1, dans lequel une pluralité d'actifs de contenu organisés en une bibliothèque partagent une valeur clef donnée.
  7. Procédé selon la revendication 1, dans lequel le service d'informatique en nuage est configuré pour rejeter des demandes pour l'actif de contenu via l'URL source qui sont reçues en provenance de tiers demandeurs autres que le CDN.
  8. Procédé selon la revendication 1, dans lequel l'URL de nuage comprend :
    un identificateur de protocole ;
    une valeur d'hôte ;
    un chemin de fichier interne fourni ; et
    un identificateur d'actif pour l'actif de contenu.
  9. Support lisible par ordinateur stockant des instructions en son sein pouvant être exécutées par ordinateur qui, lorsqu'elles sont mises à exécution par un processeur, amènent le processeur à effectuer le procédé selon l'une quelconque des revendications 1 à 8.
  10. Système pour distribuer un actif de contenu hébergé au niveau d'un service d'informatique en nuage à un dispositif client de façon interchangeable par l'intermédiaire du service d'informatique en nuage ou d'un Réseau de Distribution de Contenu, CDN, le système comprenant :
    un service d'informatique en nuage (120), incluant un processeur et un dispositif de stockage en mémoire, hébergeant des actifs de contenu à fournir à des clients autorisés ; et
    un Réseau de Distribution de Contenu, CDN (130), incluant une pluralité de processeurs et une pluralité de dispositifs de stockage en mémoire organisés en architecture multiniveau d'un bout à l'autre d'une zone géographique, conçu pour fournir les actifs de contenu en relation avec le service d'informatique en nuage,
    dans lequel le service d'informatique en nuage est configuré pour effectuer le procédé selon l'une des revendications 1 à 8.
  11. Système selon la revendication 10, dans lequel des demandes pour les actifs de contenu reçues par le CDN en provenance de dispositifs clients incluent des jetons d'autorisation et le CDN peut en outre être mis en oeuvre pour :
    interroger le service d'informatique en nuage si le jeton d'autorisation est valide ;
    en réponse à la détermination que les jetons d'autorisation sont valides, fournir les actifs de contenu aux dispositifs clients depuis lesquels les jetons d'autorisation valides ont été fournis ; et
    en réponse à la détermination que les jetons d'autorisation sont invalides, transmettre un message d'erreur aux dispositifs clients depuis lesquels les jetons d'autorisation invalides ont été fournis.
EP17771922.6A 2016-09-09 2017-09-05 Récupération interchangeable de contenu sensible par l'intermédiaire de réseaux de distribution de contenu privés Active EP3510743B1 (fr)

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
US201662385801P 2016-09-09 2016-09-09
US15/402,071 US10693947B2 (en) 2016-09-09 2017-01-09 Interchangeable retrieval of sensitive content via private content distribution networks
PCT/US2017/050000 WO2018048759A1 (fr) 2016-09-09 2017-09-05 Récupération interchangeable de contenu sensible par l'intermédiaire de réseaux de distribution de contenu privés

Publications (2)

Publication Number Publication Date
EP3510743A1 EP3510743A1 (fr) 2019-07-17
EP3510743B1 true EP3510743B1 (fr) 2021-02-17

Family

ID=61561112

Family Applications (1)

Application Number Title Priority Date Filing Date
EP17771922.6A Active EP3510743B1 (fr) 2016-09-09 2017-09-05 Récupération interchangeable de contenu sensible par l'intermédiaire de réseaux de distribution de contenu privés

Country Status (4)

Country Link
US (1) US10693947B2 (fr)
EP (1) EP3510743B1 (fr)
CN (1) CN109691057B (fr)
WO (1) WO2018048759A1 (fr)

Families Citing this family (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2018006872A1 (fr) * 2016-07-08 2018-01-11 腾讯科技（深圳）有限公司 Procédé et dispositif pour programmer l'interface d'un nuage hybride
US10375154B2 (en) 2016-07-29 2019-08-06 Microsoft Technology Licensing, Llc Interchangeable retrieval of content
EP3488590B1 (fr) * 2016-10-14 2022-01-12 PerimeterX, Inc. Sécurisation d'accès ordonné à des ressources
WO2019036481A1 (fr) * 2017-08-14 2019-02-21 Level 3 Communications, Llc Système et procédé de mise en correspondance intermédiaire de métro dans un réseau de livraison de contenu
US10637846B2 (en) * 2017-08-30 2020-04-28 Capital One Services, Llc System and method for cloud-based analytics
GB201717251D0 (en) * 2017-10-20 2017-12-06 Palantir Technologies Inc Serving assets in a networked environment
FR3075541A1 (fr) * 2017-12-20 2019-06-21 Orange Procede de distribution d'un contenu dans un reseau de distribution de contenus, entite d'origine et entites de distribution correspondantes
CN108768979B (zh) * 2018-05-17 2021-04-16 网宿科技股份有限公司 企业内网访问的方法、用于企业内网访问的装置及其系统
CN109922161B (zh) * 2019-04-10 2021-10-19 山东师范大学 动态云内容分发网络的内容分发方法、系统、设备及介质
CN111629037B (zh) * 2020-05-14 2022-05-27 山东师范大学 基于协同强化学习的动态云内容分发网络内容放置方法
EP3926926B1 (fr) * 2020-06-19 2024-02-28 Sap Se Procédé et système pour la distribution de ressources à accès restreint à l'aide d'un réseau de distribution de contenu
US11228437B1 (en) * 2021-05-21 2022-01-18 Contentful GmbH Methods for secure access to protected content in a content management system
US11843682B1 (en) * 2022-08-31 2023-12-12 Adobe Inc. Prepopulating an edge server cache

Family Cites Families (32)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6108703A (en) 1998-07-14 2000-08-22 Massachusetts Institute Of Technology Global hosting system
US6823377B1 (en) 2000-01-28 2004-11-23 International Business Machines Corporation Arrangements and methods for latency-sensitive hashing for collaborative web caching
US7240100B1 (en) 2000-04-14 2007-07-03 Akamai Technologies, Inc. Content delivery network (CDN) content server request handling mechanism with metadata framework support
US20020138437A1 (en) 2001-01-08 2002-09-26 Lewin Daniel M. Extending an internet content delivery network into an enterprise environment by locating ICDN content servers topologically near an enterprise firewall
WO2002071242A1 (fr) 2001-03-01 2002-09-12 Akamai Technologies, Inc. Selection de trajet optimal dans un reseau de distribution de contenu
US7149797B1 (en) 2001-04-02 2006-12-12 Akamai Technologies, Inc. Content delivery network service provider (CDNSP)-managed content delivery network (CDN) for network service provider (NSP)
US7133905B2 (en) 2002-04-09 2006-11-07 Akamai Technologies, Inc. Method and system for tiered distribution in a content delivery network
US20040093419A1 (en) 2002-10-23 2004-05-13 Weihl William E. Method and system for secure content delivery
CA2667696A1 (fr) 2006-09-06 2008-05-15 Akamai Technologies, Inc. Reseau de diffusion de contenu (cdn) et reseau poste a poste (p2p) hybrides
CN102047244B (zh) 2008-04-04 2013-02-27 第三雷沃通讯有限责任公司 在内容分发网络(cdn)中处理长尾内容
US8661056B1 (en) 2008-11-03 2014-02-25 Salesforce.Com, Inc. System, method and computer program product for publicly providing web content of a tenant using a multi-tenant on-demand database service
US8397073B1 (en) 2009-09-04 2013-03-12 Amazon Technologies, Inc. Managing secure content in a content delivery network
US8358660B2 (en) 2009-11-16 2013-01-22 Verizon Patent And Licensing Inc. Method and system for providing integrated content delivery
US8769614B1 (en) 2009-12-29 2014-07-01 Akamai Technologies, Inc. Security framework for HTTP streaming architecture
US9161080B2 (en) 2011-01-28 2015-10-13 Level 3 Communications, Llc Content delivery network with deep caching infrastructure
ES2425626B1 (es) 2011-05-12 2014-06-05 Telefónica, S.A. Método para la resolución de dns de peticiones de contenido en un servicio cdn
US20150207660A1 (en) 2011-12-12 2015-07-23 Google Inc. Client-side url redirection
EP3249546B1 (fr) 2011-12-14 2022-02-09 Level 3 Communications, LLC Réseau de distribution de contenu
US9088634B1 (en) 2012-05-07 2015-07-21 Amazon Technologies, Inc. Dynamic media transcoding at network edge
US9246929B2 (en) 2012-09-07 2016-01-26 Polytechnic Institute Of New York University Providing a fast, remote security service using hashlists of approved web objects
US9015212B2 (en) 2012-10-16 2015-04-21 Rackspace Us, Inc. System and method for exposing cloud stored data to a content delivery network
US9607132B2 (en) * 2012-10-22 2017-03-28 Koninklijke Kpn N.V. Token-based validation method for segmented content delivery
US9654355B2 (en) 2012-12-13 2017-05-16 Level 3 Communications, Llc Framework supporting content delivery with adaptation services
US9667747B2 (en) * 2012-12-21 2017-05-30 Akamai Technologies, Inc. Scalable content delivery network request handling mechanism with support for dynamically-obtained content policies
US9729605B2 (en) 2012-12-27 2017-08-08 Akamai Technologies Inc. Mechanism for distinguishing between content to be served through first or second delivery channels
EP2946539B1 (fr) * 2013-01-17 2020-09-02 Intel IP Corporation Fonction d'application réseau sensible à dash (d-naf)
US9935996B2 (en) 2013-02-28 2018-04-03 Open Text Sa Ulc Systems, methods and computer program products for dynamic user profile enrichment and data integration
US9549038B1 (en) 2013-08-14 2017-01-17 Amazon Technologies, Inc. Cacheable resource location selection
US9648125B2 (en) 2013-10-04 2017-05-09 Akamai Technologies, Inc. Systems and methods for caching content with notification-based invalidation
CN104580177B (zh) 2014-12-26 2018-04-27 广州酷狗计算机科技有限公司 资源提供方法、装置和系统
US9392075B1 (en) 2015-07-23 2016-07-12 Haproxy Holdings, Inc. URLs with IP-generated codes for link security in content networks
US10375154B2 (en) 2016-07-29 2019-08-06 Microsoft Technology Licensing, Llc Interchangeable retrieval of content

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
None *

Also Published As

Publication number Publication date
CN109691057A (zh) 2019-04-26
WO2018048759A1 (fr) 2018-03-15
US10693947B2 (en) 2020-06-23
US20180077222A1 (en) 2018-03-15
CN109691057B (zh) 2021-10-29
EP3510743A1 (fr) 2019-07-17

Similar Documents

Publication Publication Date Title
EP3510743B1 (fr) Récupération interchangeable de contenu sensible par l'intermédiaire de réseaux de distribution de contenu privés
US11601439B2 (en) Verifiable outsourced ledgers
US11153290B2 (en) Advanced security protocol for broadcasting and synchronizing shared folders over local area network
US10375154B2 (en) Interchangeable retrieval of content
US9516107B2 (en) Secure local server for synchronized online content management system
US11303449B2 (en) User device validation at an application server
US10454970B2 (en) Authorization of access to a data resource in addition to specific actions to be performed on the data resource based on an authorized context enforced by a use policy
KR101964293B1 (ko) 인증된 콘텐츠를 콘텐츠 소비자로 이동시키는 기법
US20100088364A1 (en) Social networking architecture in which profile data hosting is provided by the profile owner
US10635828B2 (en) Tokenized links with granular permissions
US10742586B2 (en) Assured encrypted delivery
Liu et al. Confidant: Protecting OSN data without locking it up
US11456872B2 (en) Offline protection of secrets
KR102365807B1 (ko) 도메인 포털을 통해 세션 고정을 방지하기 위한 시스템들 및 방법들
US20230137345A1 (en) System and method for decentralized user controlled social media
US20230336355A1 (en) Data protection on distributed data storage (dds) protection networks
US20230336530A1 (en) Framework For Configurable Per-Service Security Settings In A Forward Proxy
US11606426B1 (en) Database access gateway through distributed network nodes
GB2610072A (en) Data sharing via distributed ledgers
CN116743689A (zh) 带索引的加密消息备份

Legal Events

Date Code Title Description
STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: UNKNOWN

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE INTERNATIONAL PUBLICATION HAS BEEN MADE

PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: REQUEST FOR EXAMINATION WAS MADE

17P Request for examination filed

Effective date: 20190301

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

AX Request for extension of the european patent

Extension state: BA ME

DAV Request for validation of the european patent (deleted)
DAX Request for extension of the european patent (deleted)
STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: EXAMINATION IS IN PROGRESS

17Q First examination report despatched

Effective date: 20200406

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: GRANT OF PATENT IS INTENDED

INTG Intention to grant announced

Effective date: 20201020

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE PATENT HAS BEEN GRANTED

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

REG Reference to a national code

Ref country code: GB

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: CH

Ref legal event code: EP

REG Reference to a national code

Ref country code: DE

Ref legal event code: R096

Ref document number: 602017032774

Country of ref document: DE

REG Reference to a national code

Ref country code: AT

Ref legal event code: REF

Ref document number: 1362987

Country of ref document: AT

Kind code of ref document: T

Effective date: 20210315

REG Reference to a national code

Ref country code: IE

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: LT

Ref legal event code: MG9D

REG Reference to a national code

Ref country code: NL

Ref legal event code: MP

Effective date: 20210217

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: BG

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20210517

Ref country code: LT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20210217

Ref country code: HR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20210217

Ref country code: FI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20210217

Ref country code: GR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20210518

Ref country code: PT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20210617

Ref country code: NO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20210517

REG Reference to a national code

Ref country code: AT

Ref legal event code: MK05

Ref document number: 1362987

Country of ref document: AT

Kind code of ref document: T

Effective date: 20210217

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20210217

Ref country code: RS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20210217

Ref country code: PL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20210217

Ref country code: LV

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20210217

Ref country code: NL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20210217

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20210617

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SM

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20210217

Ref country code: AT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20210217

Ref country code: EE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20210217

Ref country code: CZ

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20210217

RAP4 Party data changed (patent owner data changed or rights of a patent transferred)

Owner name: MICROSOFT TECHNOLOGY LICENSING, LLC

REG Reference to a national code

Ref country code: DE

Ref legal event code: R097

Ref document number: 602017032774

Country of ref document: DE

REG Reference to a national code

Ref country code: DE

Ref legal event code: R079

Ref document number: 602017032774

Country of ref document: DE

Free format text: PREVIOUS MAIN CLASS: H04L0029060000

Ipc: H04L0065000000

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: DK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20210217

Ref country code: SK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20210217

Ref country code: RO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20210217

PLBE No opposition filed within time limit

Free format text: ORIGINAL CODE: 0009261

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT

26N No opposition filed

Effective date: 20211118

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: ES

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20210217

Ref country code: AL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20210217

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20210217

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20210217

REG Reference to a national code

Ref country code: CH

Ref legal event code: PL

REG Reference to a national code

Ref country code: BE

Ref legal event code: MM

Effective date: 20210930

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20210617

Ref country code: MC

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20210217

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LU

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20210905

Ref country code: IE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20210905

Ref country code: BE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20210930

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CH

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20210930

Ref country code: LI

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20210930

P01 Opt-out of the competence of the unified patent court (upc) registered

Effective date: 20230505

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CY

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20210217

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: HU

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT; INVALID AB INITIO

Effective date: 20170905

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: GB

Payment date: 20230823

Year of fee payment: 7

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: FR

Payment date: 20230822

Year of fee payment: 7

Ref country code: DE

Payment date: 20230822

Year of fee payment: 7

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20210217